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Sir: 

This is the Applicants'- Appellants' Reply to the Examiner's Answer of December 
30, 2005. 

The following summarizes claim limitation distinctions that were presented in the 
Appellants' Brief and unanswered in the Examiner's Answer. 

First, recall that each of the claims is dnected to ways of identifying "spoof source 
addresses". 

Relative to Claim 2: 
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Claim 2 requires that spoof source addresses are determined based on spatial 
distribution profiles. 

In response, the Examiner's Answer argued that the claimed "spatial distribution 
profiles" are the same as the Porras "continuous measures". See Answer at page 15. 

Even we with accept this unsubstantiated assumption, the Answer does not argue 
that Porras teaches to detect spoof source addresses based on "spatial distribution 
profiles" or the Porras "continuous measures". 

Thus, the arguments of the Answer do not address the specific limitations of claim 
2. There is no prima facie anticipation. 

Relative to Claim 4: 

Claim 4 requires that spoof source addresses are determined based on destination 
source address range (DSAR) distribution profiles. 

In response, the Examinees Answer argued that the claimed "destination source 
address range (DSAR) distribution profiles" are the same as the Porras "categorical 
measures". See Answer at pages 17-18. 

Even we with accept this assumption, the Answer does not argue that Porras 
teaches to detect spoof source addresses based on "destination source address range 
(DSAR) distribution profiles" or the Porras "categorical measures". 

Thus, the arguments of the Answer do not address the specific limitations of claim 
4. There is no prima facie anticipation. 

Relative to Claim 6: 

Claim 6 requires that spoof source addresses are determined based on migration 
distribution profiles of the source addresses. 
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In response, the Examiner's Answer argued that the claimed "migration 
distribution profiles of the source addresses" are the same as the Porras "continuous 
measures". See Answer at page 20. 

Nevertheless, the Answer does not argue that Porras teaches to detect spoof 
source addresses based on "migration distribution profiles of the source addresses" or the 
Porras "continuous measures'\ 

Thus, the arguments of the Answer do not address the specific limitations of claim 
6. There is no prima facie anticipation. 

Relative to Claim 8: 

Claim 8 requires that spoof source addresses are determined based on timing 
distribution profiles of the source addresses. 

In response, the Examiner's Answer argued that the claimed "timing distribution 
profiles of the source addresses" are the same as the Porras "continuous measures". See 
Answer at page 23. 

The Answer does not argue that Porras teaches to detect spoof source addresses 
based on "timing distribution profiles" or the Porras "continuous measures". 

Thus, the arguments of the Answer do not address the specific Umitations of claim 
8. There is no prima facie anticipation. 

Relative to Claim 10: 

On page 25 of the Answer, the Examiner agreed that Porras does not teach 
determining whether filtering actions are to be taken to filter out packets vwth source 
addresses that are deemed to be spoofed source addresses and how those filtering actions 
should be distributed among the routing devices as required by claim 10. 

Yet on page 26, the Answer argues that the Porras patent 'implies' such teachings 
to the Examiner. 
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Counsel is not familiar this new legal standard being proposed in the Answer: 
anticipation by 'implication'. 

Summary 

The present claimed invention is directed to using very specific types of profiles, 
e.g., spatial distribution profile, destination source address range (DSAR) distribution 
profile, migration distribution profile of the source addresses, and timing distribution 
profile of the source addresses, to determine whether instances of source addressed are 
spoof source addresses. 

The Porras patent is of technical interest insofar at it teaches general types of 
profiles, termed categorical or continuous measures. 

What is missing from the Porras patent, however, are teachings of the specific 
claimed profiles— spatial distribution profiles, destination source address range (DSAR) 
distribution profiles, migration distribution profiles of the source addresses, and timing 
distribution profiles of the source addresses. 

Moreover, the Porras patent does not teach that even its continuous or categorical 
measures should be used to detect address spoofing. The continuous or categorical 
measures are generated by the Porras profile engine 22. See Porras patent at col. 5, lines 
50-53. Whereas, the Porras patent uses its signature engine 24 to detect spoofmg. See 
Porras patent at col. 7, 43-44. Signature detection uses pattern matching instead of 
statistical profiling to detect problems. 

For these reasons, Applicants-Appellants believe that the above-discussed claims, 
and their analogs, are not anticipated by the applied reference. 
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Should any questions arise, please contact the undersigned. 



Respectfully submitted, 




sgistrationNo.: 35,900 
4 Militia Drive, Ste. 4 
Lexington, MA 02421 
Tel.: 781-863-9991 
Fax: 781-863-9931 



Date: February 28, 2006 
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